UCF STIG Viewer Logo

The operating system must restrict the ability of individuals to use USB storage devices.


Overview

Finding ID Version Rule ID IA Controls Severity
V-59699 AOSX-10-000850 SV-74129r2_rule Medium
Description
External hard drives, such as USB, must be disabled for users. USB hard drives are a potential vector for malware and can be used to exfiltrate sensitive data, if an approved data-loss prevention (DLP) solution is not installed.
STIG Date
Apple OS X 10.10 (Yosemite) Workstation Security Technical Implementation Guide 2017-04-06

Details

Check Text ( C-60469r1_chk )
If an approved HBSS DCM/DLP solution is installed, this is not applicable.

To ensure external USB drives are disabled, run the following command:

system_profiler SPConfigurationProfileDataType | grep -A 3 harddisk-external

If the option 'eject,alert' is not set for 'harddisk-external', this is a finding.
Fix Text (F-65109r2_fix)
This setting is enforced using the "Restrictions Policy" configuration profile.